xray-examples Configuration Guide

The choice of the target domain/website used in REALITY significantly impacts latency, speed, and stability. Consider the following factors:

1. Proximity/Stability: The target website should be close to the server and stable (avoid sites that might rate-limit frequent handshake requests).
2. ISP Priority: Some operators grant higher traffic priority to specific domains.
3. GFW Lists: Be aware of GFW blacklists (e.g., Google) and whitelists (e.g., Microsoft).

The domainStrategy setting in the WireGuard outbound determines how Xray resolves domain names before sending the connection through the WireGuard tunnel.

When using gRPC or H2 transports, it is recommended to use a VPS with optimized return routing (e.g., CN2-GIA, AS9929/AS10099, CMI/CMIN2, AS4837). Performance is highly dependent on low latency between the client and the VPS.

To improve stability and performance, consider:

1. Following NaïveProxy Performance Tuning guidelines.
2. Using the healthCheck parameter in your Xray configuration to monitor connection quality.

WSS is considered deprecated for high-security needs due to several identifiable features:

• ALPN Fingerprint: WSS often sends an ALPN of http/1.1, making it easily identifiable.
• Handshake Timing: The extra WebSocket handshake creates unique timing signatures.
• TLS in TLS: WSS is susceptible to TLS in TLS detection.

Recommendations:

• Do not use WSS.
• If you must use WSS, use early data by appending ?ed=2048 to mitigate handshake issues.
• Use REALITY or gRPC over CDN instead.

You can fetch WARP credentials in sing-box format using the following command. You will need to extract the IPv6 address, private_key, and reserved values for your Xray configuration.

• IPv6 Address: Replace 2606:4700:: in your config with this address (append /128).
• private_key: Paste this value into the secretKey field.
• reserved: Paste this array into the reserved field.

curl -sL "https://api.zeroteam.top/warp?format=sing-box" | grep -Eo --color=never '"2606:4700:[0-9a-f:]+/128"|"private_key":"[0-9a-zA-Z\/\+]+="|"reserved":\[[0-9]+(,[0-9]+){2}\]'

Alternatively, you can use the warp-reg.sh script via a one-line bash command.

bash -c "$(curl -L warp-reg.vercel.app)"

Since REALITY acts as a port forwarder for non-REALITY clients, accessing the IP directly via a browser will likely result in certificate errors or unexpected responses.

To correctly verify the REALITY port forwarding using a browser:

1. Modify your system's hosts file.
2. Map the target domain (the one used in REALITY's serverName) to your server's IP.
3. Access the target domain via the browser. You should see a normal response, and the browser's Network tab (F12) will show the connection is actually established with your server's IP.

To minimize the risk of port or IP blocking when using XTLS Vision, follow these configuration requirements:

1. Server-side IP Management: Use a clean IP and ensure the server blocks all domestic (China) IP traffic to prevent your local IP from being flagged via timing correlation.
2. Port Configuration: Use reasonable ports and strictly forbid domestic traffic.
3. Protocol Isolation: Configure the server to use only XTLS Vision. Do not allow compatibility with standard TLS proxies.
4. Fallback Behavior: Configure the server to fall back to a standard webpage, or do not implement fallback/splitting to other proxy protocols.
5. Client-side Fingerprinting: Ensure the client has uTLS (fingerprint) enabled.

Note: Even with correct configuration, 100% protection is not guaranteed. If a port is blocked, try changing the port, the IP, or the service provider.